#!/bin/bash
set -e

cluster=${1}
days=5000

cd /etc/kubernetes/${cluster}/pki

# ca
[ -f ca.key ] || openssl genrsa -out ca.key 2048
[ -f ca.crt ] || openssl req -x509 -new -nodes -key ca.key -subj "/CN=kubernetes-ca" -days ${days} -out ca.crt

# apiserver
[ -f apiserver.key ] || openssl genrsa -out apiserver.key 2048
[ -f apiserver.csr ] || openssl req -new -key apiserver.key -subj "/CN=kube-apiserver" -out apiserver.csr -config openssl.cnf
[ -f apiserver.crt ] || openssl x509 -req -in apiserver.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out apiserver.crt -days ${days} -extensions v3_req  -extfile openssl.cnf

# apiserver-kubelet-client
cat > openssl-client.cnf <<EOF
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth
EOF
[ -f apiserver-kubelet-client.key ] || openssl genrsa -out apiserver-kubelet-client.key 2048
[ -f apiserver-kubelet-client.csr ] || openssl req -new -key apiserver-kubelet-client.key -out apiserver-kubelet-client.csr -subj "/O=system:masters/CN=kube-apiserver-kubelet-client"
[ -f apiserver-kubelet-client.crt ] || openssl x509 -req -in apiserver-kubelet-client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out apiserver-kubelet-client.crt -days ${days} -extensions v3_req -extfile openssl-client.cnf

# front-proxy-ca
[ -f front-proxy-ca.key ] || openssl genrsa -out front-proxy-ca.key 2048
[ -f front-proxy-ca.crt ] || openssl req -x509 -new -nodes -key front-proxy-ca.key -subj "/CN=kubernetes-front-proxy-ca" -days ${days} -out front-proxy-ca.crt

# front-proxy-client
[ -f front-proxy-client.key ] || openssl genrsa -out front-proxy-client.key 2048
[ -f front-proxy-client.csr ] || openssl req -new -key front-proxy-client.key -out front-proxy-client.csr -subj "/CN=front-proxy-client"
[ -f front-proxy-client.crt ] || openssl x509 -req -in front-proxy-client.csr -CA front-proxy-ca.crt -CAkey front-proxy-ca.key -CAcreateserial -out front-proxy-client.crt -days ${days} -extensions v3_req -extfile openssl-client.cnf

# sa
[ -f sa.key ] || openssl genrsa -out sa.key 2048
[ -f sa.pub ] || openssl rsa -in sa.key -pubout -out sa.pub

# etcd
cd etcd
# etcd ca
[ -f ca.key ] || openssl genrsa -out ca.key 2048
[ -f ca.crt ] || openssl req -x509 -new -nodes -key ca.key -subj "/CN=etcd-ca" -days ${days} -out ca.crt

# etcd server
[ -f server.key ] || openssl genrsa -out server.key 2048
[ -f server.csr ] || openssl req -new -key server.key -subj "/CN=kube-etcd" -out server.csr -config openssl.cnf
[ -f server.crt ] || openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days ${days} -extensions v3_req  -extfile openssl.cnf

# etcd peer
[ -f peer.key ] || openssl genrsa -out peer.key 2048
[ -f peer.csr ] || openssl req -new -key peer.key -subj "/CN=kube-etcd-peer" -out peer.csr -config openssl.cnf
[ -f peer.crt ] || openssl x509 -req -in peer.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out peer.crt -days ${days} -extensions v3_req  -extfile openssl.cnf

# etcd healthcheck-client
[ -f healthcheck-client.key ] || openssl genrsa -out healthcheck-client.key 2048
[ -f healthcheck-client.csr ] || openssl req -new -key healthcheck-client.key -out healthcheck-client.csr -subj "/O=system:masters/CN=kube-etcd-healthcheck-client"
[ -f healthcheck-client.crt ] || openssl x509 -req -in healthcheck-client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out healthcheck-client.crt -days ${days} -extensions v3_req -extfile ../openssl-client.cnf

# kube-apiserver-etcd-client
cd ..
[ -f apiserver-etcd-client.key ] || openssl genrsa -out apiserver-etcd-client.key 2048
[ -f apiserver-etcd-client.csr ] || openssl req -new -key  apiserver-etcd-client.key -out apiserver-etcd-client.csr -subj "/O=system:masters/CN=kube-apiserver-etcd-client"
[ -f apiserver-etcd-client.crt ] || openssl x509 -req -in apiserver-etcd-client.csr -CA etcd/ca.crt -CAkey etcd/ca.key -CAcreateserial -out apiserver-etcd-client.crt -days ${days} -extensions v3_req -extfile openssl-client.cnf


# clean csr files
rm -f /etc/kubernetes/${cluster}/pki/*.csr
rm -f /etc/kubernetes/${cluster}/pki/etcd/*.csr

echo "done"
